Ransom.1138 removal guide

The Ransom.1138 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.1138 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• CAPE detected the PyInstaller malware family

How to determine Ransom.1138?

File Info:
name: A5260C5D6ADECD257749.mlw
path: /opt/CAPEv2/storage/binaries/b113beddeda497d4f21f32e47dad3f8c2ed3b49e9101cab5197a5926899dd4e7
crc32: 283349A2
md5: a5260c5d6adecd2577498d8262e96454
sha1: 56425deee4db5b90158e2e30ec186fd5f3b32ed1
sha256: b113beddeda497d4f21f32e47dad3f8c2ed3b49e9101cab5197a5926899dd4e7
sha512: 06566d65d57a45bdd78a2036d356bb1793848e98452aed961433bc9828d07f380b6931588ebec433b685743179b187937d2f3fc3749234fefb14ad1423389268
ssdeep: 98304:EYS6RPfWVLiPwoPllMWHu5GCGQ3s+1mVp0rfBiO52uTACITfQf/i3wzjqsF:l5ooP1H5CPsimvlG2xCsQfatS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F13633B5CDB421C2C36A57358C95FC490AB986AF81920772D597F48E48F3E82EA4FC4D
sha3_384: 8d190abd06bfcca0f50c0ef22678a03fad733e376b9d3bd1957942c7ca0881684c59f7936b3e71afdb9e1d7ef5bac97b
ep_bytes: 60be000043008dbe0010fdff57eb0b90
timestamp: 2020-01-05 12:16:35

Version Info:
0: [No Data]

Ransom.1138 also known as:

How to remove Ransom.1138?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.